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REMARKS 

This Application has been carefully reviewed in light of the Office Action 
electronically mailed March 23, 2009. Claims 1-5, 7-10, 12-21, 23-26, 28-37, 39-42, and 44- 
60 are currently pending. Claims 1-5, 7-10, 12-21, 23-26, 28-37, 39-42, and 44-55 are 
allowed. Claims 56-60 are rejected. Applicant respectfully requests reconsideration and 
allowance of all pending claims. 

Status of Claims 

Applicant notes with appreciation the Examiner's indication in the Office Action 
Summary and first paragraph of the Detailed Action that Claims 1-10, 12-21, 23-26, 28-32, 
34-42, and 44-55 are allowed. However, Applicant notes that in the second paragraph of the 
Detailed Action, the Examiner rejects Claims 1-10, 12-19, 33-37, 39-42, 44-50, and 52-60 
under 35 U.S.C. § 101. Therefore, in an abundance of caution, Applicant responds to these 
rejections accordingly. 

Additionally, the Examiner notes that Claims 11, 22, 27, 33, and 43 have been 
cancelled. However, Applicant believes this list includes several typographical errors. 
Applicant respectfully notes that Claims 6, 11, 22, 27, 38, and 43 are the Claims that have 
been cancelled in the present Application. 

Section 101 Rejections 

The Examiner rejects Claims 1-10, 12-19, 33-37, 39-42, 44-50, and 52-60 under 35 
U.S.C. § 101. 1 Applicant respectfully traverses these rejections. 

The Office Action rejects Claims 1 and 56, stating that they are not tied to a particular 
machine. Office Action, pg. 3. Applicant has amended Claims 1 and 56 so that each recites a 
"computer-implemented method." Furthermore, Claims 1 and 56, as amended, recite 
particular steps performed "using a central processing unit." As such, Applicant respectfully 
contends that Claims 1 and 56, along with their respective dependent Claims, are tied to a 
particular machine and therefore recite statutory subject matter. 

The Office Action rejects Claim 17, stating that it does not include a hardware 
component. Office Action, pg. 3. Applicant has amended Claim 17 to include "one or more 

1 Applicant notes that Claims 20-21, 23-26, 28-32, and 51, although not explicitly rejected under 35 U.S.C. 
§ 101, depend from Claims that are explicitly rejected. Therefore, Applicant assumes that Claims 20-21, 23-26, 
28-32, and 5 1 were also intended to be rejected. Applicant responds accordingly. 
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central processing units operable to execute" particular elements. As such, Applicant 
respectfully contends that Claim 17, along with its dependent Claims, includes hardware and 
therefore recites statutory subject matter. 

The Office Action rejects Claim 33, stating that a computer readable medium may 
encompass a non-statutory electronic transmission signal. Office Action, pg. 3. Applicant 
has amended Claim 33 to recite a "tangible computer-readable storage medium." As such, 
Applicant respectfully contends that Claim 33, along with its dependent Claims, recites 
statutory subject matter. 

For at least these reasons, Applicant respectfully requests reconsideration and 
allowance of Claims 1-10, 12-21, 23-26, 28-37, 39-42, and 44-60. 

Section 103 Rejections 

The Examiner rejects Claims 56-60 under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent Publication No. 2004/0123117 issued to Berger ("Berger") in view of U.S. 
Patent No. 7,469,419 issued to Sobel ("Sober). Applicant respectfully traverses these 
rejections. 

Claim 56 is directed to a computer-implemented method for computer security. The 
method includes identifying a file. The method also includes determining, using a central 
processing unit, quantitative information regarding the file, the quantitative information 
selected from the group consisting of a length of time the entry has been in the database of 
unfamiliar software, a number of times the file has been opened, and a number of times an 
executable in the file has been executed. The method further includes adding an entry for the 
file to a database of known good software if the quantitative information exceeds a 
predetermined value. Applicant respectfully contends that the proposed Berger-Sobel 
combination fails to disclose, teach, or suggest each and every one of these limitations. 

For instance, the Office Action relies on Berger as disclosing adding an entry for the 
file to a database of known good software if the quantitative information exceeds a 
predetermined value. Office Action, pg. 4. Applicant respectfully disagrees. Berger is 
directed toward a method of detecting potentially malicious action of a potentially unsafe 
application. Berger, Abstract. While server system 130 may be "updated to reflect that a 
potentially unsafe application is now a known safe application or a known unsafe 
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application," there is no teaching, disclosure, or suggestion that this update is performed "if 
the quantitative information exceeds a predetermined value." 

Additionally, the Office Action states that Berger does not disclose determining 
quantitative information regarding the file, the quantitative information selected from the 
group consisting of a length of time the entry has been in the database of unfamiliar software, 
a number of times the file has been opened, and a number of times an executable in the file 
has been executed. Office Action, pgs. 4-5. Instead, the Office Action relies on Sobel as 
disclosing this limitation. Office Action, pg. 5. Applicant respectfully disagrees. 

Sobel is directed to a system and method for determining whether a computer file has 
been infected with malicious code by an attacking agent. Sobel, Abstract. This may be 
detected by determining whether a file has been changed since a critical date, wherein the 
critical date is a date when the file is believed to have been free of infection. Sobel, col. 1, 
lines 55-67. Applicant respectfully contends that merely determining whether a file has been 
changed fails to disclose, teach, or suggest determining the length of time the entry has been 
in any database, let alone a database of unfamiliar software. The cited portions of Sobel 
similarly fail to disclose, teach, or suggest determining a number of times the file has been 
opened or the number of times an executable in the file has been executed. For at least these 
reasons, Applicant respectfully contends that Sobel fails to disclose, teach, or suggest the 
quantitative information required by Claim 56. Therefore, Applicant respectfully requests 
reconsideration and allowance of Claim 56. 

Claims 57-60 depend, either directly or indirectly from Claim 56 and incorporate all 
the limitations thereof. As shown above, the proposed Berger-Sobel combination fails to 
disclose, teach, or suggest each and every element of Claim 56. Therefore, for at least the 
reasons discussed above, Applicant respectfully requests reconsideration and allowance of 
Claims 57-60. 
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Conclusion 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other apparent reasons, Applicant respectfully requests full 
allowance of all pending Claims. If the Examiner feels that a telephone conference or an 
interview would advance prosecution of this Application in any manner, the undersigned 
attorney for Applicant stands ready to conduct such a conference at the convenience of the 
Examiner. 

Although Applicant believes no fee is due, the Commissioner is hereby authorized to 
charge any required fee or credit any overpayment to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 
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